Skip to main content

Checkpoint firewall common commands part1

Checkpoint firewall common commands part1

For starting or stopping firewall services
cpstop-Stop all Check Point services except cprid . You can also stop specific services by issuing an option with cpstop. For instance cpstop FW1 stops FW-1/VPN-1 or use cpstop WebAccess to stop WebAccess.
cpstart-Start all Check Point services except cprid . cpstart works with the same options as cpstop .
cprestart-Combined cpstop and cpstart . Complete restart.
cpridstop, cpridstart, cpridrestart-Stop, start or restart cprid , the Check Point Remote Installation Daemon.
fw kill [-t sig] proc-Kill a Firewall process. PID file in $FWDIR/tmp/ must be present. Per default sends signal 15 (SIGTERM).Example: fw kill -t 9 fwm
fw unloadlocal– Uninstalls local security policy and disables IP forwarding.
For getting basic firewall information :
fw ver [-k] , fwm [mds] ver, vpn ver [-k], fgate ver-Show major and minor version as well as build number and latest installed hotfix of a Check Point module. Show additional kernel version information with -k switch.
ver-Show CP version and build as well as kernel info.
cpshared_ver-Show the version of the SVN Foundation.
cpview-Tool combining several Check Point and Linux commands into a great text based tool providing both OS and software blade information.
fw stat, fw stat <-l|–long>, fw stat <-s|–short> -Show the name of the current policy and a brief interface list. Use -l or -s for more info. Consider using cpstat fw instead of -l or -s switch for better formatted output.
fw ctl iflist-Display interface list.
fw ctl arp [-n]-Display proxy arp table. -n disables name resolution.
cp_conf finger get-Display fingerprint on the management module.
cp_conf client get-Display GUI clients list.
cp_conf admin get-Display admin accounts and permissions. Also fwm -p
cp_conf auto get <fw1|fg1|rm|all> – Display autostart state of Check Point modules.
Labels:

Comments

Post a Comment

Popular posts from this blog

How to modify SSH/HTTP/Telnet time out in Cisco ASA firewall?

How to modify SSH/HTTP/Telnet time out in Cisco ASA firewall? By default tcp idle timeout is 1:0:0 hh:mm:ss. If in case you need to modify it you can do it by MPF (Modular Policy Framework). Let us setup a custom timeout when traffic is coming from particular host 10.77.241.129. !— Match the traffic using the access-list —! object-group service DM_INLINE_TCP_1 tcp port-object eq www port-object eq ssh port-object eq telnet access-list outside_mpc extended permit tcp host 10.77.241.129 <source ip> any object-group DM_INLINE_TCP_1 !— Define the class map Cisco-class –! class-map Cisco-class match access-list outside_mpc !— Call this class-map into policy map and set the connection reset after 10 min when traffic is coming from particular host —! policy-map Cisco-policy class Cisco-class set connection timeout idle 0:10:00 reset !— Apply the policy-map Cisco-policy on the interface. —! service-policy Cisco-p...
Post a Comment
Read more

Checkpoint firewall common commands part 2

Checkpoint firewall common commands part 2 For basic firewall informaton gathering: fgate stat -Status and statistics of Flood-Gate-1. fwaccel <stat|stats|conns>  – View status, statistics or connection table of SecureXL. fw getifs -Show list of configured interfaces with IP and netmask. cpstat <app_flag> [-f flavour] -View OS, HW and CP application status. Issue cpstat without any options to see all possible application flags <app_flag> and corresponding flavours. Examples: cpstat fw -f policy – verbose policy info cpstat os -f cpu – CPU utilization statistics cpinfo -y all   -List all installed patches and hotfixes. cpd_sched_config print -Show task scheduled with CPD scheduler. enabled_blades -View enabled software blades avsu_client [-app <app>]   , get_version <app>  -Get signature version and status of content security .Without the -app option “Anti Virus” is used. show co...
Post a Comment
Read more

CLI Commands for Troubleshooting FortiGate Firewalls

CLI Commands for Troubleshooting FortiGate Firewalls 2015-12-21 Fortinet , Memorandum , Network Cheat Sheet , CLI , FortiGate , Fortinet , Quick Reference , SCP , Troubleshooting Johannes Weber This blog post is a list of common troubleshooting commands I am using on the FortiGate CLI . It is not complete nor very detailled, but provides the basic commands for troubleshooting network related issues that are not resolvable via the GUI. I am not focused on too many memory, process, kernel, etc. details. These must only be used if there are really specific problems. I am more focused on the general troubleshooting stuff. I am using it personally as a cheat sheet / quick reference and will update it from time to time. Coming from Cisco, everything is “show”. With Fortinet you have the choice confusion between show | get | diagnose | execute . Not that easy to remember. It is “ get router info6 routing-table” to show the routing table but “ diagn...
Post a Comment
Read more